Perl Code Security Scanner Other than RATS? (MUST BE _STATIC_)

Question

Other than RATS, are there any other Perl security scanners?

Possibly also any STATIC only perl code graph engine which has an ability to follow data-flow or otherwise tainted input?

Answer 1

Perl::Critic implements a number of security checks largely based upon the book Perl Best Practices. Given that Perl::Critic is written using the PPI parser, it probably can achieve much greater introspection than RATS can.

That said, no code scanner or utility is going to find security errors that are the result of just poor programming practices. A few simple best practices can go a long way. The perlsec manpage goes into detail about many Perl security issues, and has some good practical advice.

From my own experience auditing mountains of bad code:

• Always use taint mode (-T flag)
• Always use strict
• Always use warnings
• Always use placeholders in DBI code
• Always scrutinize and sanitize any input before using it as a filename, method/function name, or argument to a system call
• Avoid string eval whenever possible; it's inefficient, anyway. Never put user input into an eval string.

I'm sure there's more that I'm not remembering at the moment, but it's late. :)

Answer 2

With respect to a graph engine, I just found PPI

---

Parse, Analyze and Manipulate Perl (without perl)

---

Key features include;

---

1. Documentation (of perl code)
2. Structural and Quality Analysis
3. Refactoring
4. Layout
5. Presentation